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Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS. 

WHICHEVER IS LONGER. FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event. hov\/ever, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply Is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )KI Responsive to communication(s) filed on 02 October 2003 . 
2a)\3 This action is FINAL. 2b)^ This action is non-final. 

3) n Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Clalnfis 

4) 13 Claim(s) 1-28 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) n Claim(s) is/are allowed, 

6) 13 Claim(s) 1-28 is/are rejected. 
?)□ Claim(s) is/are objected to. 

8) n Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) n The specification is objected to by the Examiner. 

10) S The drawing(s) filed on 02 October 2003 is/are: a)K accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing{s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) 0 The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) n Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)n All b)n Some * c)^ None of: 

1 .□ Certified copies of the priority documents have been received. 

2. n Certified copies of the priority documents have been received in Application No. . 

3. n Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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1 ) ^ Notice of References Cited (PTO-892) 4) □ Interview Summary (PTO-41 3) 

2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) Paper No(s)/Mall Date. . 

3) (3 Infomiation Disclosure Statement(s) (PTO/SB/08) 5) □ Notice of Infomnal Patent Application 

Paper No(s)/Mail Date 7/21/06 . 6) □ Other: . 
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DETAILED ACTION 

Information Disclosure Statement 

1 . The information disclosure statement (IDS) submitted on July 21 , 2006 is in 
compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure 
statement is being considered by the examiner. 

Claim Rejections - 35 USC § 101 

2. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

Claims 26 and 28 are rejected under 35 U.S.C. 101 because the claimed invention is 

directed to non-statutory subject matter. The claims recite of a computer readable 

medium and on page 4, lines 3-5, the applicants specification indicates that the medium 

can be communication links. The examiner suggest amending the claims to recite of a 

"computer readable storage medium" to overcome the rejection. 

Claim Rejections - 35 USC § 102 

3. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
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applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21 (2) 
of such treaty in the English language. 

4. Claims 1-28 are rejected under 35 U.S.C. 102(e) as being anticipated by 
Smittison et al, U.S. Patent 6,802,012. 

As per claim 1, Smithson et al teaches of a method for classifying a message, 
comprising extracting a plurality of reference points; classifying the plurality of reference 
points; and detecting that the message is a phish message based on the classified 
reference points (col. 2, lines 49-55; col. 2, line 63 through col. 3, line 4; and col. 5, lines 
32-61). 

As per claim 2, it is disclosed by Smithson et al wherein classifying the plurality of 
reference points including looking up the plurality of reference points in a database (col. 

5, lines 46-65). 

As per claim 3, it is taught by Smithson et al wherein detecting that the message 
- is a phish message includes determining that the message includes divergent reference 
points (col. 5, lines 54-61). 

As per claim 4, it is disclosed by Smithson et al wherein detecting that the 
message is a phish message includes determining that the plurality of reference points 
includes a first reference point to a first source and a second reference point to a 
second source (phish message includes determining that the message includes 
divergent reference points (col. 5, lines 54-61). 

As per claim 5, Smithson et al teaches wherein detecting that the message is a 
phish message includes determining that the plurality of reference points includes a first 
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reference point to a legitimate source and a second reference point to a questionable 
source (col. 5, lines 54-61). 

As per claim 6, Smithson et al discloses wherein detecting that the message is a 
phish message includes determining that the plurality of reference points includes a first 
reference point to a first source and a second reference point to a second source, and 
the second reference point is intended to appear as a reference to the first source (col. 
5, lines 54-61). 

As per claim 7, it is taught by Smithson et al of computing a thumbprint of the 
message and storing the thumbprint to a database (col. 5, lines 46-65). 

As per claim 8, it is disclosed by Smithson et al of computing a thumbprint of the 
message and storing the thumbprint to a database; wherein the database is shared (col. 
5, lines 46-65). 

As per claim 9, Smithson et al of identifying a plurality of fraud indicators and 
applying a statistical analysis on the plurality of fraud indicators (col. 5, lines 54-61). 

As per claim 10, Smithson et al discloses of quarantining the message (col. 5, 
line 66 through col. 6, line 4). 

As per claim 1 1 , it is taught by Smithson et al of deleting the message (col. 5, line 
66 through col. 6, line 4). 

As per claim 12, it is disclosed by Smithson et al of providing an alert to a 
recipient of the message (col. 5, line 66 through col. 6, line 4). 

As per claim 13, it is taught by Smithson et al of providing an alert to a recipient 
indicating that the message is a phish message (col. 5, line 66 through col. 6, line 4). 
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As per claim 14, Smithson et ai discloses of providing an explanation of the phish 
message to a recipient (col. 5, line 66 through col. 6, line 4). 

As per claim 15, Smithson et al teaches of a method for classifying a message, 
comprising identifying a plurality of fraud indicators in the message; applying a statistical 
analysis on the plurality of fraud indicators; and determining whether the message is a 
fraudulent message based on the analysis (col. 2, lines 49-55; col. 2, line 63 through 
col. 3, line 4; and col. 5, lines 32-61). 

As per claim 16, it is disclosed by Smithson et al wherein identifying the plurality 
of fraud indicators includes identifying a raw Internet protocol (IP) address (col. 5, lines 
54-61). 

As per claim 17, Smithson et al teaches wherein identifying the plurality of fraud 
indicators includes identifying non-standard encoding in the message (col. 5, lines 54- 
61). 

As per claim 18, it is disclosed by Smithson et al wherein identifying the plurality 
of fraud indicators includes identifying a link with an embedded user name (col. 5, lines 
54-61). 

As per claim 19, it is taught by Smithson et ai wherein identifying the plurality of 
fraud indicators includes identifying a misleading link (col. 5, lines 54-61). 

As per claim 20, Smithson et al discloses wherein identifying the plurality of fraud 
indicators includes identifying a mismatched link name (col. 5, lines 54-61). 
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As per claim 21, Smithson et al teaches wherein identifying the plurality of fraud 
indicators includes identifying a form in the message (col. 5, line 66 through col. 6, line 
4). 

As per claim 22, Smithson et al discloses wherein identifying the plurality of fraud 
indicators includes identifying a form in the message that requests special information 
(col. 5, line 66 through col. 6, line 4). 

As per claim 23, it is disclosed by Smithson et al wherein identifying the plurality 
of fraud indicators includes identifying suspect content in the message (col. 5, lines 54- 
61). 

As per claim 24, it is disclosed by Smithson et al wherein applying a statistical 
analysis on the plurality of fraud indicators includes obtaining a score based on the 
fraud indicators (col. 5, lines 54-61). 

As per claim 25, Smithson et al teaches of a system for classifying a message, 
comprising a processor configured to extract a plurality of reference points, classify the 
plurality of reference points, and detect that the message is a phish message based on 
the classified reference points; and a memory coupled with the processor, wherein the 
memory is configured to provide the processor with instructions (col. 2, lines 49-55; col. 
2, line 63 through col. 3, line 4; and col. 5, lines 32-61). 

As per claim 26, Smithson et al discloses of a computer program product for 
classifying a message, the computer program product being embodied in a computer 
readable medium and comprising computer instructions for extracting a plurality of 
reference points; classifying the plurality of reference points; and detecting that the 
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message is a phish message based on the classified reference points (col. 2, lines 49- 
55; col. 2, line 63 through col. 3, line 4; and col. 5, lines 32-61). 

As per claim 27, it is taught by Smithson et al of a system for classifying a 
message, comprising a processor configured to identify a plurality of fraud indicators in 
the message, apply a statistical analysis on the plurality of fraud indicators and 
determine whether the message is a fraudulent message based on the analysis; and a 
memory coupled with the processor, wherein the memory is configured to provide the 
processor with instructions (col. 2, lines 49-55; col. 2, line 63 through col. 3, line 4; and 
col. 5, lines 32-61). 

As per claim 28, it is disclosed by Smithson et al of a computer program product 
for classifying a message, the computer program product being embodied in a computer 
readable medium and comprising computer instructions for: identifying a plurality of 
fraud indicators in the message; applying a statistical analysis on the plurality of fraud 
indicators; and determining whether the message is a fraudulent message based on the 
analysis (col. 2, lines 49-55; col. 2, line 63 through col. 3, line 4; and col. 5, lines 32-61). 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Christopher A. Revak whose telephone number is 571- 
272-3794. The examiner can normally be reached on Monday-Friday, 6:30am-3:00pm. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on 571-272-3795. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status infomiation for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



CR 



February 3, 2008 



CHRISTOPHER REVAK 
PRIMARY EXAMINER 




